immich mergerfs

clusters/base/apps/davical/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: davical-secrets
     namespace: pim
 stringData:
-    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:UiwviXpRrBeL7dWIHHVSB9DvsHMbmHa+16SVnEx6GASFONWIyg+IjxGskiJxDl1X,iv:SUA+3oxHo2/Gy0Mo9W+O37bk97gbwQAhluIbB3rfbkU=,tag:0IGTKZed11H2bCefwH/8uA==,type:str]
+    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:/PTuUu4mxQGnwYWXu2F+oSZs83bThqrMmnVg4QEFs5U3vRELC1Y9B7ljHQmfa+Dy,iv:mROnkAdrBknqb8LE4dxEqd0t+ikKLB8bmBjZYGHVYT4=,tag:XxeFtw3V4wa/39Myh+AsZQ==,type:str]
-    PASSDAVDB: ENC[AES256_GCM,data:NjlXZvbe+uuw9TaK7XyDxPuICmI92gtbK8WO2pMWDXDjcWJ0KKasuyCn+x7svJQV,iv:xgnwG6jfBy4KrkZ5v7cX4pLgDVpRii1MjhfEkHYidp8=,tag:aLLUdEWgt9JbkB/ULmTSww==,type:str]
+    PASSDAVDB: ENC[AES256_GCM,data:n/hQIuYYId06jg9FDjsQQuWIHrTV08hSXfKspxPjJtpkMmeAVRAKUl7W3qMUHHTG,iv:NrRa3GdNRYq2dmKsvd3B1sz0goV6NEB4JvL4/xDlSXI=,tag:Cg1HPknlk9rg8SxRktrEMg==,type:str]
-    ADMINDAVICALPASS: ENC[AES256_GCM,data:0AVyTVm8kx/4O+IXzaGWeBV0oAkeba0cktnqBo+j4PM=,iv:Qg8JtkGOr1mXDGI7/QslXLFk7Rnp9etcZRfY+FZsowU=,tag:MkrG4h8cuMz8czfDJrzeog==,type:str]
+    ADMINDAVICALPASS: ENC[AES256_GCM,data:Z+RjBVGEfFOvob/H3K7gvYsYmPKWaGpFh7e1zr0s8dI=,iv:81z0pLTjjViI3WcxJNjuMgyS3Dqr7xiFsGoU7DtWYQQ=,tag:oey5cwF3wUEr+iteaNWXvw==,type:str]
 sops:
     age:
         - recipient: age1yx8mey02c0mu6te9hwxwdqp5n4enjz35e8thchsmvhqw7xsrzy0syg367g
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvdm13VGMzSWJXaTlrTmRR
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSTHB5TElUZXNNRjZCVC9P
-            ckV3YVR6WXo0eFJ0UzFVY1pWajBpcUFFbnp3CndzWmV5cVZ1TE1vYlZTK0dhZzNv
+            dXhub1JVUGY1MkR6SGVvYmZwYVRNTDUvNWlnCnZucE5mSS9HNE4wWGxrVUNucVla
-            ajdWZWNBOElXVG96RmR4L1g0Y2FGZkEKLS0tIEg3OWlNZTA4bE9NTVlMei9yUXZL
+            K0gwM3Rwc3NqbWh0dFdwTGF4TjMyVFEKLS0tIGNUUFgyajFZbldXczR6Q1RnUWN2
-            NXhuQjhpekxJaTZMWmlrckxxOXk1T2sKUAIdm3EdXTMN2CEK46E82VFaDQXWOpRt
+            eFJWZ0J1TGF5RStON2ZTQ1FqSGdCcHcK6ltsoYLyLyhFIdvI6l+BzlOyshv6UXlf
-            YkVsk3BjmPQ5HYGbLlI9hp0oPmxk8Qj35xgnC9SJ53WhF7MW1HU3Pg==
+            ztyD6II3nK867NC+3U8ydhVak7S26ZcV7UO9z7YzZtglW6+nX9OfPw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:19Z"
+    lastmodified: "2026-08-26T10:28:29Z"
-    mac: ENC[AES256_GCM,data:JkJMdEb7Q0ttxXFLGqkWxY6Ka67WYQSDTEIS0kN6xZ9yHKkSz49598hRrgrVEa2vYrrI+3wD1J9zo5HNl694m50z2s9FwQAJXJHlooYjLPygfYLDgmBQeif+VI3oHVOYpCCDckfiTw3XHO7hTIw60anN7RNGsl/g5AOzdPi9VPQ=,iv:h2NsrZaFAhQGV05ArVkN7zv+cgRLHRBGerppiI054tE=,tag:IVkDEC3s5LYe5ObO2FVfIg==,type:str]
+    mac: ENC[AES256_GCM,data:nkHRKLOf3XJGIxFR35xZ6Kz39Uqj7k7s6a9o9uyXou6X4Azt0JY2/g8bPlmvHc36FMAsoh4ZkcYkGfHggddtNhJS633bbct0YJY9b9LSJr2S+HNZrJgMstns39nRNZCAFeXotITCe2QtG1+Xj3oDjHDGdQWDqapxLKW/Nytv93E=,iv:gNDGnCoXhsE1aZABiTolsm55dG3SNIE8PFtgomTUNJs=,tag:PvCQH2bELO9YfMTrLZRoqQ==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/immich/configmap-rsync.yaml

@@ -13,23 +13,34 @@ data:
     import json
     from datetime import datetime, timezone
 
-    SRC = "/source/"
+    # source mirrors immich's own folder layout 1:1 (library, backups,
-    DST = "/data/"
+    # encoded-video, profile, thumbs, upload all sit directly under this).
+    SRC_ROOT = "/source"
+    LIBRARY_RECENT_DST = "/disks/library-recent"
+    LIBRARY_ARCHIVE_DST = "/disks/library-archive"
+    OTHER_DST = "/data"
     OUT_DIR = "/www"
+    FILELIST_DIR = "/tmp/filelists"
+    CUTOFF = datetime(2025, 7, 1, tzinfo=timezone.utc).timestamp()
+
+    PHASES = ["listing", "library (recent)", "library (archive)", "other folders"]
 
     state_lock = threading.Lock()
     state = {
         "status": "starting",
+        "phase": "",
+        "phases_done": [],
         "percent": 0.0,
         "processed": 0,
         "total": 0,
         "rate": "",
         "eta": "",
         "bytes_transferred": "",
+        "recent_files": 0,
+        "archive_files": 0,
         "started_at": None,
         "finished_at": None,
         "error": None,
-        "returncode": None,
     }
 
     # matches lines from `rsync --info=progress2`, e.g.:
@@ -44,15 +55,20 @@ data:
 
     def render_html(s):
         progress_html = ""
-        if s["status"] == "scanning":
+        if s["status"] in ("syncing", "done", "error") and s["phase"]:
-            progress_html = "<p>Building file list...</p>"
-        elif s["status"] in ("syncing", "done", "error"):
             progress_html = f"""
+    <p>Phase: <b>{s['phase']}</b></p>
     <p>Progress: {s['processed']} / {s['total']} files ({s['percent']:.1f}%)</p>
     <div class="bar"><div class="fill" style="width:{s['percent']:.1f}%"></div></div>
     <p>Transferred: {s['bytes_transferred']} bytes &middot; {s['rate']} &middot; ETA {s['eta']}</p>
     """
+        elif s["status"] == "listing":
+            progress_html = "<p>Scanning source and splitting library by date...</p>"
         error_html = f"<p class='err'>Error: {s['error']}</p>" if s["error"] else ""
+        phases_html = "".join(
+            f"<li>{'&#10003;' if p in s['phases_done'] else ('&rarr;' if p == s['phase'] else '&middot;')} {p}</li>"
+            for p in PHASES
+        )
         return f"""<!doctype html>
     <html><head><meta charset="utf-8"><title>Immich NAS rsync</title>
     <meta http-equiv="refresh" content="5">
@@ -60,19 +76,22 @@ data:
     body {{ font-family: monospace; background: #111; color: #eee; padding: 2rem; }}
     table {{ border-collapse: collapse; }}
     td {{ padding: .25rem 1.5rem .25rem 0; }}
+    ul {{ list-style: none; padding: 0; }}
     .bar {{ background: #333; border-radius: 4px; overflow: hidden; width: 300px; height: 14px; }}
     .fill {{ background: #4caf50; height: 100%; }}
     .err {{ color: #f66; }}
     </style></head><body>
     <h1>Immich NAS rsync</h1>
-    <p>{SRC} &rarr; {DST}</p>
+    <p>{SRC_ROOT} &rarr; library (split by date) + everything else</p>
     <p>Status: <b>{s['status']}</b></p>
+    <ul>{phases_html}</ul>
     {progress_html}
     {error_html}
     <table>
+    <tr><td>Library files &ge; 2025-07-01</td><td>{s['recent_files']}</td></tr>
+    <tr><td>Library files &lt; 2025-07-01</td><td>{s['archive_files']}</td></tr>
     <tr><td>Started</td><td>{s['started_at'] or '-'}</td></tr>
     <tr><td>Finished</td><td>{s['finished_at'] or '-'}</td></tr>
-    <tr><td>Exit code</td><td>{s['returncode'] if s['returncode'] is not None else '-'}</td></tr>
     </table>
     </body></html>"""
 
@@ -93,21 +112,32 @@ data:
         os.replace(tmp, os.path.join(OUT_DIR, "stats.json"))
 
 
-    def run_rsync():
+    def split_library_by_date():
+        """Walk source/library once, bucket relative file paths by mtime."""
+        lib_root = os.path.join(SRC_ROOT, "library")
+        recent, archive = [], []
+        if os.path.isdir(lib_root):
+            for dirpath, _dirs, files in os.walk(lib_root):
+                for name in files:
+                    fp = os.path.join(dirpath, name)
+                    try:
+                        mtime = os.stat(fp).st_mtime
+                    except OSError:
+                        continue
+                    # rsync --files-from always wants "/"-separated paths
+                    rel = os.path.relpath(fp, lib_root).replace(os.sep, "/")
+                    (recent if mtime >= CUTOFF else archive).append(rel)
+        return recent, archive
+
+
+    def run_rsync(args, phase_label):
         with state_lock:
-            state.update(status="scanning", started_at=datetime.now(timezone.utc).isoformat())
+            state.update(status="syncing", phase=phase_label, processed=0, total=0, percent=0.0,
+                         bytes_transferred="", rate="", eta="")
         write_output()
 
         proc = subprocess.Popen(
-            [
+            args,
-                "rsync",
-                "-a",
-                "--info=progress2",
-                "--no-inc-recursive",
-                "--outbuf=L",
-                SRC,
-                DST,
-            ],
             stdout=subprocess.PIPE,
             stderr=subprocess.STDOUT,
             text=True,
@@ -124,7 +154,6 @@ data:
             if m:
                 bytes_transferred, percent, rate, eta, _xfr, to_chk_left, to_chk_total = m.groups()
                 with state_lock:
-                    state["status"] = "syncing"
                     state["bytes_transferred"] = bytes_transferred
                     state["percent"] = float(percent)
                     state["rate"] = rate
@@ -141,23 +170,78 @@ data:
                 last_write = now
 
         returncode = proc.wait()
+        if returncode != 0:
+            raise RuntimeError("".join(tail[-5:]).strip() or f"rsync exited {returncode}")
 
+
+    def run_filelist_rsync(src_dir, dst_dir, filelist_path, phase_label):
+        run_rsync(
+            [
+                "rsync", "-a", "--info=progress2", "--no-inc-recursive", "--outbuf=L",
+                f"--files-from={filelist_path}", src_dir, dst_dir,
+            ],
+            phase_label,
+        )
+
+
+    def run_other_folders():
+        run_rsync(
+            [
+                "rsync", "-a", "--info=progress2", "--no-inc-recursive", "--outbuf=L",
+                "--exclude=library", SRC_ROOT + "/", OTHER_DST + "/",
+            ],
+            "other folders",
+        )
+
+
+    def main_flow():
         with state_lock:
-            state["returncode"] = returncode
+            state.update(status="listing", phase="listing", started_at=datetime.now(timezone.utc).isoformat())
-            state["finished_at"] = datetime.now(timezone.utc).isoformat()
+        write_output()
-            if returncode == 0:
+
-                state["status"] = "done"
+        recent, archive = split_library_by_date()
-                state["percent"] = 100.0
+        with state_lock:
-            else:
+            state["recent_files"] = len(recent)
-                state["status"] = "error"
+            state["archive_files"] = len(archive)
-                state["error"] = "".join(tail[-5:]).strip() or f"rsync exited {returncode}"
+            state["phases_done"].append("listing")
+        write_output()
+
+        os.makedirs(FILELIST_DIR, exist_ok=True)
+        recent_list = os.path.join(FILELIST_DIR, "recent.txt")
+        archive_list = os.path.join(FILELIST_DIR, "archive.txt")
+        with open(recent_list, "w") as f:
+            f.write("\n".join(recent))
+        with open(archive_list, "w") as f:
+            f.write("\n".join(archive))
+
+        lib_src = os.path.join(SRC_ROOT, "library") + "/"
+        run_filelist_rsync(lib_src, LIBRARY_RECENT_DST + "/", recent_list, "library (recent)")
+        with state_lock:
+            state["phases_done"].append("library (recent)")
+        write_output()
+
+        run_filelist_rsync(lib_src, LIBRARY_ARCHIVE_DST + "/", archive_list, "library (archive)")
+        with state_lock:
+            state["phases_done"].append("library (archive)")
+        write_output()
+
+        run_other_folders()
+        with state_lock:
+            state["phases_done"].append("other folders")
         write_output()
 
 
     def main():
         os.makedirs(OUT_DIR, exist_ok=True)
         write_output()
-        run_rsync()
+        try:
+            main_flow()
+            with state_lock:
+                state.update(status="done", percent=100.0, finished_at=datetime.now(timezone.utc).isoformat())
+        except Exception as e:
+            with state_lock:
+                state.update(status="error", error=str(e), finished_at=datetime.now(timezone.utc).isoformat())
+        write_output()
         # stay alive so the pod doesn't restart-loop after a one-shot sync;
         # the status page keeps showing the final result.
         while True:

clusters/base/apps/immich/helmrelease-server.yaml

@@ -13,6 +13,66 @@ spec:
   values:
     controllers:
       server:
+        strategy: Recreate
+        podDisruptionBudget:
+          maxUnavailable: "0"
+        initContainers:
+          fix-permissions:
+            image:
+              repository: hectorm/nfs-ganesha
+              tag: v10
+            command:
+              - sh
+              - -c
+              - chmod -R a+rwX /disks/library-recent /disks/library-archive
+          # native sidecar (restartPolicy: Always): mounts the two library
+          # disks and exposes their union at /disks/merged-library via
+          # FUSE. It must be up and actually mounted *before* the "app"
+          # container is created, since HostToContainer propagation only
+          # relays mounts made *after* the receiving container's own mount
+          # exists - it won't retroactively pick up a FUSE mount that's
+          # already there. Running it as a restartPolicy:Always init
+          # container (started, gated on the startupProbe below, before
+          # regular containers) guarantees that ordering; a regular sidecar
+          # container racing "app" on every pod start does not. Same
+          # pattern as clusters/base/apps/nfs-photo.
+          mergerfs:
+            dependsOn:
+              - fix-permissions
+            restartPolicy: Always
+            image:
+              repository: ghcr.io/hotio/mergerfs
+              tag: release-v2.42.0
+            args:
+              - "-o"
+              # library-recent listed first: category.create=ff means new
+              # files created through the merged mount (i.e. new immich
+              # uploads going forward) land on library-recent by default,
+              # which is exactly what's wanted for freshly-uploaded photos.
+              - "allow_other,use_ino,func.create=ff,category.action=all,category.create=ff,category.search=newest"
+              - "/disks/library-recent:/disks/library-archive"
+              - "/disks/merged-library"
+            securityContext:
+              privileged: true
+            probes:
+              startup:
+                enabled: true
+                custom: true
+                spec:
+                  exec:
+                    command:
+                      - sh
+                      - -c
+                      - grep -q fuse.mergerfs /proc/mounts
+                  periodSeconds: 1
+                  timeoutSeconds: 2
+                  failureThreshold: 30
+            resources:
+              requests:
+                cpu: 50m
+                memory: 64Mi
+              limits:
+                memory: 512Mi
         containers:
           app:
             image:
@@ -54,10 +114,12 @@ spec:
               limits:
                 memory: 4Gi
           # one-shot migration copy from the old NAS-hosted docker install
-          # into this install's own library volume (see "library" below).
+          # into this install's own volumes (see "persistence" below).
           # rsync is idempotent, so a pod restart mid-copy just resumes
           # cleanly; once done it sleeps forever instead of exiting, so the
           # container doesn't restart-loop and the status page stays up.
+          # (starts after all initContainers - fix-permissions and the
+          # mergerfs sidecar's startupProbe - complete, same as "app")
           rsync:
             image:
               repository: python
@@ -68,10 +130,10 @@ spec:
               - apk add --no-cache rsync >/dev/null && python3 /app/rsync.py
             resources:
               requests:
-                cpu: 50m
+                cpu: 100m
-                memory: 64Mi
-              limits:
                 memory: 256Mi
+              limits:
+                memory: 1Gi
           rsync-web:
             image:
               repository: nginx
@@ -141,16 +203,71 @@ spec:
               - rsync.photo.aggtaa.com
 
     persistence:
-      # brand new, dedicated library - deliberately not reusing the old
+      # Immich's "library" folder, mergerfs-merged from two disks: recent
-      # docker-compose install's NAS data, and not nfs-photo either.
+      # files (per the rsync migration's cutoff) and everything else.
-      library:
+      # New uploads going forward land on library-recent (see mergerfs
+      # category.create above). Not reusing the old single 800Gi library
+      # PVC/PV - this replaces it (that PVC becomes orphaned, retained,
+      # and unused; clean it up separately if no longer wanted).
+      library-recent:
         type: persistentVolumeClaim
         accessMode: ReadWriteOnce
-        size: 800Gi
+        size: 200Gi
         storageClass: longhorn-single-replica
         retain: true
-        globalMounts:
+        advancedMounts:
-          - path: /data
+          server:
+            mergerfs:
+              - path: /disks/library-recent
+            fix-permissions:
+              - path: /disks/library-recent
+            rsync:
+              - path: /disks/library-recent
+      library-archive:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 500Gi
+        storageClass: longhorn-single-replica
+        retain: true
+        advancedMounts:
+          server:
+            mergerfs:
+              - path: /disks/library-archive
+            fix-permissions:
+              - path: /disks/library-archive
+            rsync:
+              - path: /disks/library-archive
+      merged-library:
+        type: emptyDir
+        advancedMounts:
+          server:
+            mergerfs:
+              - path: /disks/merged-library
+                mountPropagation: Bidirectional
+            app:
+              - path: /data/library
+                mountPropagation: HostToContainer
+      dev-fuse:
+        type: hostPath
+        hostPath: /dev/fuse
+        advancedMounts:
+          server:
+            mergerfs:
+              - path: /dev/fuse
+      # everything immich keeps outside "library" (backups, encoded-video,
+      # profile, thumbs, upload) - plain volume, no mergerfs involved.
+      other:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 100Gi
+        storageClass: longhorn-single-replica
+        retain: true
+        advancedMounts:
+          server:
+            app:
+              - path: /data
+            rsync:
+              - path: /data
       nas-source:
         type: persistentVolumeClaim
         existingClaim: immich-nas-source

clusters/base/apps/immich/pv-pvc-nas-source.yaml

@@ -14,7 +14,11 @@ spec:
     - nolock
   nfs:
     server: 10.0.64.80
-    path: /mnt/sdb2/immich
+    # .../uploads specifically, not just .../immich: this aligns 1:1 with
+    # immich's own folder names (library, backups, encoded-video, profile,
+    # thumbs, upload) sitting directly under /source, matching what
+    # rsync.py expects.
+    path: /mnt/sdb2/immich/uploads
     readOnly: true
   claimRef:
     namespace: photo

clusters/base/apps/immich/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: immich-secrets
     namespace: photo
 stringData:
-    DB_PASSWORD: ENC[AES256_GCM,data:V480mcVwcvNf038oqzwUaJ2/uW8TDWvgDdHSvcjZj2E=,iv:JJOpmFKE990M5Qrna5ygzHarBG8OXblVGX7cgrZG9V4=,tag:Y7TUANsHOyfo0fUNyuJK8g==,type:str]
+    DB_PASSWORD: ENC[AES256_GCM,data:hQbH4veR4gJOZH8zY71mqinSrKU63KkEtjJaKiImjCU=,iv:oVfNqGyHEGZzb9kCnS4yUC5nnXCCm7VYJ5SPwJn7AyE=,tag:vbe2rQW4V5MeZqVx6/U/6w==,type:str]
 sops:
     age:
         - recipient: age1wmm8qrqnjzvd5nkraed6ylrsxlpn3ru7d7zettdudj7y9sg9dd2su0u3mr
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUR1BmSkUvQk5ma2lXd3Zh
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkOE1oa1J4bnU4eDdqOHZY
-            QlpuQ1RiY3R5RTF3U2ZtclE2cVRKc2hpcTJRCmN5eCtJVzZuNERxUFIwMEY3TjZG
+            YmNDeHRKTzQ1TWI0L2pqZ3lNTkRaUVQva0drCklMbHU0S05YakgwVXE4Q2RFTmw4
-            Z2lmbXRXblNyVWs4U2NxZ1hob0N5YkkKLS0tIFljK3U5K0xBTUxnTE5iV25aU1Ji
+            TGU1bGFIQ0ZjTXpEMVk3RENzSWlUTkkKLS0tIEx3UTBXTGRvVGd3TjdETlVFWUdn
-            dTd2L25wb240VzBQVjJxc01WbERaUk0Kpr9LZ8y4VMc1Ad842LaE1aUVLKckPZhj
+            M0J4TmZCam5jOHNnOWlqOW9hTnNvRTQKR2X0uze2pVEmQ54atawqZ8P9RL9fSQyX
-            5Q2aB+ae+MEgdKztyQFcOEnIfha4cY4QtwswVHlyaWKLi8VL7eYq7g==
+            IyBSB6KIj1LTtlDfTerXZ8asJBl/FWAJNZMTsL1wZq4+vTOdR/BvlA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:20Z"
+    lastmodified: "2026-08-26T10:28:29Z"
-    mac: ENC[AES256_GCM,data:fPJevt8TqMrs2FOcT83e0dP6IMRjzWFk89XWfnavM8adRpJbRxc4qULG+umIZDUa7597ncvOQXIO0zM2DfoKDVANRVT6aqtgo8HOcsVRu07MB43jpMM2s8E16MT1o8+6K3XWJvqXu71OX8zVCVLIC1Ea2yypHY6af8c9XggzRiw=,iv:FJwRrkAzB2Cs3198PA3e0i8lUqj63BNI5q8iVq1zELs=,tag:0EXmxh9zIxLgN7g/NMxRjQ==,type:str]
+    mac: ENC[AES256_GCM,data:M2y12n6Q2fI7kqi5eAIZxGlwUemWsnabXmvRHS0C2AGN5b00sfxSti1M/fZXP9ubjZR+Ms1D0dta8dyAcCPdSNQMzGew5x4Cdv6CLkcXaTbORI5Bl2X2E8XRwDeZYuM9F4hpPnXa02MaCFQyIQiLyhk6m9xz9GlNCqCSejZOr8M=,iv:uK3ya99vk0AXWVyvA0B0UMDmHEJUOOGHKydaanPGkLQ=,tag:lRtmmkv8bCh6GBxtON7L0g==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/markdown-vault-mcp/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: markdown-vault-mcp-secrets
     namespace: mcp
 stringData:
-    BEARER_TOKEN: ENC[AES256_GCM,data:bLg+EroQN9axxV2nKn6PCK6hYBpwXwpQINRhbWBe7UXz2u08LY7oAFNVmXT1A99j4Zrb0r1iHT0kBfGRDnGCqw==,iv:OEACakrv5TZuqEvBkfoK7h7nSfQddk1YaZf7+RhoRQw=,tag:Ri/6XjEXCdreIpRFgLKyqw==,type:str]
+    BEARER_TOKEN: ENC[AES256_GCM,data:/5wHS4TFUzbVgvL//s7nIor1roI8LaEI92ag37bp5APhICqCigdNHCDv8rr3vUf+Ss+CxZoYTNkgZsieus36Tg==,iv:i2H2rL434MTnlcRLq+lI8mu7ao7DmDc/TPT/xB6q0UQ=,tag:DAN4aUknohmHF/kW5aFayQ==,type:str]
-    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:RSIzvdT7QjA1NSwv6X8w47tvZgjtXeYdemwXC5c9JIh+uxWIcJ255+xAGccCkRYWjJKMOd6y4Wpx6fCeUpOGNA==,iv:3P0NH/jlbWFXhEADHMgMfiRc02W07C2Ud48/0LdGuqc=,tag:Mes+NfqVXKi0QV/VtlpdUw==,type:str]
+    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:oleyhjc47S0he4zsU2grRQZvfXntT6hC2nqTGayQT++OMACMI6W1VoeyTYu0AJFIIYBU5bldLnXnJZyOlEGkmA==,iv:qjeXO1aFsRSboxgNYL0/RvKUSSKO+zevEhcKZpJlMCo=,tag:JzZCKxJfoUrge0PTB5nb0w==,type:str]
-    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:AXLonI9YCjD2H4cJuqzKsFuHCPvHpFcY/thQzeTQnRUrW7vydSLp772KOd6JdmH5bnMxbpU7egT56UyaNVor6g==,iv:KKuSzwJEdgwMT4P+3bHxzYN6ABJFjjwfS19/e4GwzVM=,tag:brXhZ4CWEON3jX7gWtEQHA==,type:str]
+    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:ac8Et8AxqWJIElTkU/5mtnow7LCmCDungLtEGI/7hZwr/KGtKX1q4rppmBhgb4odEfMjG2yUNXbHqGbDF+nX8A==,iv:PQkSr2/sPGk8FoGkuRFcC+Iy1FjhHa7vlTeDxKKJo6Q=,tag:rfGcZDUExxWViCwkwgVSdw==,type:str]
 sops:
     age:
         - recipient: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJSzZDS3BZYlk2U05OYmh0
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5VjNiM2ZTMGNPdTdPUnpM
-            M1NQMGhyV1dnNUdwSFdVWTBKVjBBbjZiS0NFClg4eDZxVVo5c09Cd1pJQ2VNYVRH
+            K21uRUJQaEtDRW1SRWJVR0FNSGcyL1JIQWc4ClBrd0dQR1ZlQWx1VEdqRDVTVUwv
-            U2lQWEwyMko2N21qWDBTQjBnbWgrUk0KLS0tIFM5RjVnQWJ2Sk5TMGN6a1orOE5O
+            QVZzQnRKcUZYNmg3a1dVQlZBQnRtZEUKLS0tIDM1YUUrTXR4Q2JoWXpyZkpPdFRp
-            MVMzd1MraU1rSktXb3JZYUNpSGRtOHMKI+FQwpQLtLbCSJqvrPCWXFunxL++Ldxq
+            TWkramFkZjFhUG9JamR6RXZIRXRNSHcK0d30Tdc14MsJ2lzbv8ftj0VP0IM3yPDR
-            kraQjEvoKP0x+1yDJ9vIjk52M8UOdymNfC5MqCcqh8qDGIN4w2F01A==
+            Ow/c+IA4nz7YMKeOfTGF5sd4VWVwFN0zBxPB4i0LECa56HZ7n5yCnQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:21Z"
+    lastmodified: "2026-08-26T10:28:30Z"
-    mac: ENC[AES256_GCM,data:QA/pon4UbZp5LSSFwxz5AP6NnnqE5iu2a7RqmaAJThmNmP244GMmtTVd7RwJM8VKLCERq8is2rfGxvZqpfZUurlNp0V2ck08d7GdM9IZ3fvxDuVDZuyKkKKgaxY+24aFtXxXaZeA9U3KCmfRyvzTrICK/PFWcUcZFXfQH9y7SAU=,iv:9uBv9bVhsKuMaZf30vxffz2iwfDyJs7pLcu7z2Xs4fg=,tag:xiFCZ2c7BetZOL9GzvJ9PA==,type:str]
+    mac: ENC[AES256_GCM,data:PNOwmif0L2j/wwYkLmgJNBw0Vb9qMpDr8+1fhZZ8CvHuVurZ4ycor5xElV3UTUGun1DAlU5cPhud41GQ1MvUADbVwzPTtlQNkC/8vuDRr0nQIhx+UaGRB+6j/5gvfKqigauX1aeV2xIoF0uZdoGY1g91tdyNoIS6CD1l61AS3GY=,iv:B/HkBrHT93lunnGU84EL05gvaTFzyU3cwBSfeu5t22E=,tag:bIGrLJkUeHJ9hEtE0LwXNA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/mosquitto/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: mosquitto-passwd
     namespace: mqtt
 stringData:
-    passwd: ENC[AES256_GCM,data:JSJ5JnyjgL38Ghd1b0ahCMBYY72BLjGqCf4SW8spmRjcWNCN6QUoW09ol1aCjBAzm4NoILEcWGQSwyDPxxtPp/ovr1SRYH+nqsIDtV8q7fkrAWV4WVe6mZvZF96yNgAsVr3nIiGN+4anBDdQgSmA4r5N7XEtBE45g1qXarAFH4zzxeL7+VV37uKCTx7yl/cUIgIKHf957MDkKMj3ds5WY56mceyzZvUxnEHYNvNMIns+bZc3dHuECYZ9udiZFg==,iv:eS6Tog3BUsChxEh9JqA5uvfws05Wg6XjixG0OQeDpos=,tag:0gToxnDZqlArEWW9D6f1Hw==,type:str]
+    passwd: ENC[AES256_GCM,data:zVGrqFMcQKR5vNAtjPzVriJlsv4ivyo/2QC18YD681aY1H6Iqrz3SwNYoY3ddE9wK4/dQ1304UkgOr7YXbYbMWiF0MfE1sKiYycdk79IqTHWxAWZhXAwZVPiWMNoS8M54oPQ/2bzoU5+gvBHKSG42omvWF9JajDZ5rzOAtOszlC7LgT/EVZbiNWKkElpGqmYtO68o4jUa2S5znsV4H1wv4KOdqJFXlv0j8L+73yXhrslH5xMaCwbvmVNqAS2UQ==,iv:8EqQ9pM4jrrhzyx/q8ndo6Wzby+xq+ChZKwsP+IfVTg=,tag:Nog8bBqw/5Q2FmdD47d2xg==,type:str]
 sops:
     age:
         - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoM0tlNlhmVlFSU1NWS0Rq
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0ekRwV0NJV1JFc1lVSzQ5
-            VnU4TUpZeGRHSlk2U25Rck5PRkhLRVZiZWlJCkJOalk2S213TjF5bytJSnplYTl2
+            QVduYVRaVjRZVVdDL1JMZWpzR3FwVVVwWVZZCjdRQVZIcGpWYXBselQxWThya0NZ
-            Z3Uvd3p2OFByZE10Y0N5YzNIbGd6ZGcKLS0tIGR1MUF4NzZZUHF4cGZQczZZM3lV
+            TC9DdTYxdis3MTZBU1NJYnZhdkdRYWMKLS0tIDhZR3BjTEd4TEFaUlRXdi9QcVlh
-            c0sydGxNcmhZVHpzRG1iZmpKMnU1djgKW8SQAoJTlzwx4sRGQNE7usCyj3jRPjMb
+            MlRCbXJUakJueTVTa3VGR2pVaktMZWcKhsOXlkRM6Pr5S9LJt2yYdMJxtXQfvzV8
-            MgUSOoBjNMgekrkOp4AaIrvfhDowYfXZo4V+Y0Zi3WUaPI27+GWuxw==
+            2fYO1EBcsj94PqflpGxPSpBjLvvioiMdQ3tsSSIaaznWYPX5YIiQbg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:22Z"
+    lastmodified: "2026-08-26T10:28:31Z"
-    mac: ENC[AES256_GCM,data:tEFry2RqRUQWYqcAV8XYqo4C8MIVtGkn6Q2cp42nwnx7u8Wo5LhZPb8hDXC4zW5r528e8nVdEAfB6l0qqoP2bB0TMuc0s+9zo1mv8fP01cgjFRWZt/ihPrkwrRqSzBlDuhycxZTf+ultWfW8zingK84E1QS6b8XmLOfoloMU5og=,iv:9ivGUUgwC5j5QBtiUA7Bmke+Rfceq8+iVSCUL3VVTeA=,tag:esOuudkUTFT2/F1KM6QwTg==,type:str]
+    mac: ENC[AES256_GCM,data:KARZJRsC4DmzVjdZSonCACCQVOQ72sAYjzD6Wojap4EFjLE0CBQMb9ZguRE47aTO6b5X7s4ltNlYJ6LsAtCyDA3DdggYaRIwNjotzxc7LzRXykszTUgjqN5cSBgf30NLXH9h2PaU54vjRwhOedAOEHUTR/MoxlkKZ/ryoLAtJpk=,iv:qV29VID24dPRHVY+RxpZX2ecGaJTBjxujvAHfsb03Dg=,tag:ALEiuI7REJJa9qE0ZJ+9Kw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:YvfbDywA5Aa1cLXRbpeMteEVaO2cKe6PfGE5YAhsCE19EL/krEbgySnBB/eVgwUB0x02FIoeHH5R,iv:Yo1Th9mhhWgg1lg3WGOmphaiAow7MQHUeLxLoFl+mS8=,tag:nrVJUc5MSH8LiyflRMezmw==,type:comment]
+    #ENC[AES256_GCM,data:4iLAaNssxEjpapC9wJr1DtKzE9tzV7rNp/dDbW92dEWaYflpbI7fDJaPGbnD5N7OGeAXaWtP2EJh,iv:i0GPZ/XWCdNJZt1Sy2RTn2OB3ufYLozxvmADBnyAgnc=,tag:2hAzue8wQ/MgoNcUMmINzA==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:8pnbjmLfPK/r+C2YLGrvv9cc917f3UZAlxiHVxWeC8vhsIrdZN54o1wH2rCpSMoCSgxQ00HOVmzFrp3axVDdsZq/spD1cI/+Mgyps6Th3iCRJ3hvAqXUt7kgPudn+cRaSEWnVuYr95jhXz2ZrzJjdCqhR+ysjg==,iv:MyGW8QqX7oGAYMmTq5egeT8AsVIfK2M+OJi1zXW1kP0=,tag:zSB4Tsw3Hexa9kMvkQw2HA==,type:str]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:bVdm5vb0HTu2UwL8tvnNppZfuLgjd9H7sy1xP/So+yGzLfeX3a3vQogKqWKLRmja6XMYhvQfhNIXgykixrxKYuwdhoWgbCsaYoLr5JMovsd6s5AjC7klhR8ubdRQ4eh82CG5AkDf+cNnACSrsORpdSON87Kneg==,iv:MrCEkjdtUj3jRYpY7nip1OZlRroseleu7T5maSO5Plg=,tag:LqDwwtCKlIBufCeXjzo4cw==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBUdGFIcEE3Q3JJUGhBVmRZ
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZcWc1U2cyekZyaFQ5UTRY
-            d3RFOHFIZVM0bXFSVFpCUFl6c3ltZ2l4N1dFCndJczFDMTl2eTR6c0NNSE8zVGht
+            V2Jjam1STTgvcHlRMjg2bjlsQjV1eWlucUQ4CnR3dFFoT0l2MFY5QTc2TjhlbDg2
-            SjRLSkhWdUhOMFpJcC9LdHpIRDBKdUUKLS0tIHJDR0ZYUmNhTEVxaVNHY0lLbzVy
+            K0Z4MmVFdVE5alVvZzlYTnBObnNBU2cKLS0tIE9ZRS95T3ZEVUF5TVQ4MUVRSGxF
-            MG16OHZ4V09idmtKOUdGSHdDbzJvQmcKcfQ+5x7Kf4jizM8WnNhdvUMlO7uzHeL7
+            eStHK3oxcUdzazNnY1J5MkZtZTY4dUEKof+V/AJ7DCcdGHVo0kZsPwFd9X7sDtyo
-            N4e9iiHalv690x0D/s/nTUj1dnh+XSaNoMUkk1xHC0VVgAtwSkSEBg==
+            Nrc0xlVH1+OwTXnta991CIyKFmssV637US6zdy2EkAH53po7hSdELg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:23Z"
+    lastmodified: "2026-08-26T10:28:32Z"
-    mac: ENC[AES256_GCM,data:SGraFRZHyRjPt7vc/RMcnazm8S+McHIxtvpBP1uVk6BQA+etipOHvgQqHAoYPqaxedTyQYzKtFtE4UZ+H/VaWrUStzCCqXIPLDVFdwNmWZIik/PI405ZzP/qSQ6yXOGDsh4nGkroDfx8eEk+JozIUaI/FXn6rWdhSMx4oEqTZsc=,iv:JyIDk/CVZvZu7zRJp7aGks63QIOrDArYZkC8FSZRpQM=,tag:VWrj/mf7KaS5hgdvmg62tg==,type:str]
+    mac: ENC[AES256_GCM,data:U8O7RfZ0yBQIWTsPaNILCVT4nhVfPRANAABZI+LCvHF4Nrf69LQCTPiaoXwAuNK02jEZwrT5LmkS6vfiEBotvsy9VvwmF4uwW/3WwxF9EnfMi6YdRJ1Yb1rRJKfPrHCFuPrd0odj0lBeKalOGyd+B4xzWMZpONzIQZpbwPBiDx8=,iv:k11/B5N3sPUbZfLesdeVLNHsUkdVXjLvzJ5jrXRqwps=,tag:XabU7gCEXzEE/6Uqm8PO4w==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/webdav/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: webdav-secrets
     namespace: webdav
 stringData:
-    WEBDAV_USERNAME: ENC[AES256_GCM,data:ZFnNYuY=,iv:x9PbhOg6ndMLaFCrN3EWPEtAP0F7XW6ehQxZjXDI5mQ=,tag:kxVec9N2C910uufvEmWAEQ==,type:str]
+    WEBDAV_USERNAME: ENC[AES256_GCM,data:nZdShvc=,iv:N9d/RLw7/LIA4KQPgnE3+/8oSeXP+U+7flrr6bRtkpk=,tag:ck/SX0JE2MlsbbppjKGAuw==,type:str]
-    WEBDAV_PASSWORD: ENC[AES256_GCM,data:ErL7fy4BPWeFnKJXtaFBkEeCUR1pOeRwrAcvp0frChVyhI4KYiXQSIH7OV/3NOF+,iv:V/e/c2gSKqy8+dfGFRVNNX3AJniydhytzQpY+vCeHlY=,tag:ACHUROM23yb9EF3a45A5wA==,type:str]
+    WEBDAV_PASSWORD: ENC[AES256_GCM,data:bKj44og7bLk4J1nOk+NYJozcRrCIO8oLC2YDKiuIOp+/mP1hzociGkXiw5XMSsck,iv:pflTHT61DL8llQa6BVRjjvK2O+sXtjWVX0l6uDpkX3o=,tag:BfYjYK9VsqihrNo4VECHcw==,type:str]
 sops:
     age:
         - recipient: age1y8t9v56yuvskznddqfsd4yddzzch0yf2dutvvt8rrx6rjh5f9g0s3qeays
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4b2g5NzVDT3FOYUlXK0di
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZMEY5MlBsSTFRdlFCZ3dy
-            TndpZE1YS3BaLzUzSVhYaVVXUndEcXNPbW1RCis1ZmQ2bWFtMlRGejRlSkRvakdn
+            L2J2c0FqL3lmS045U2J5VGRnb3pPdWpLa1NnCmpjWFdqaVEwblovaHFEb3ZhMDlw
-            RTVHVHM3NlNmVkFBbEpLNS9ZblMwRDQKLS0tIFZ0eE5kTExIYmVaZk5WMHFJUnZW
+            TXc1TnZabjBIZFkwVkxYelFCbUQ1d28KLS0tIG1ENEZqQ21qaGhMZWhiL1JrWnFh
-            b1J3Y21zVDV1R1lMbnoyWmxKM210azAK3FkhKAiIa1ZJcKTmCvf+ssF1wIrMYrlT
+            TjExckwrTW4rV1NkQndNeUF2WWJZcFEKaOpXhoR5e20zWvACdNGfIJxusZ+AC+Nn
-            7GIP8x+82CsUV9daAemqIUZQwJqszPOb+Cc81bUfKrAZFaPjvPB5VA==
+            KnG6v8sQl34aylw+TeTR3ibmTupToyZoX6mVUXBdLDCzB8CT+hxehA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:23Z"
+    lastmodified: "2026-08-26T10:28:32Z"
-    mac: ENC[AES256_GCM,data:3ZYQBa5suwDiDfgnuy9FvmA7iKxcjX7pR03m88iT/uqKMLk0QpjgLHz4vs+CxWUQ2SljCMSHpsz4kgCplP0aVKVlDmBAwplkY6CZfjkujrAV2Unw76QiAM9nrA710rf9FSIHeUVcbh9Y3KsdwWNb0D83Q309HxTUy/TphrpXBUQ=,iv:wY0iBlNTcvZRPCIXHfsQojW5bXWjYvvyK8sB8Z4RW4E=,tag:bbf6F/PDm/+zlrlhlLvQqw==,type:str]
+    mac: ENC[AES256_GCM,data:SfFGemzruM6xmH22/TPV93JjIbZmgVopRh/6gQPlpZ6PxksKEzFXBU3VwIAYigr1xNmSInGB67+DCWMWZ9eDWnG0cb9kxdGEd7wH5lPAJp7Lpkibnv3bT9qxE7vOZkdJbe+9OF6a/x3xbMeaszYXzEVq3X0LeEoIYNFvDssJGBM=,iv:owir/2ULkuVr6CeKTS02UMvpIAFR2hVE8WpefRpyRck=,tag:MuA4NzXTsx5wsNA9v+a5Nw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:mkmuzF2YPaYSStkApWN43mO1t2eb7S4b2Xh9gvrq6ngEgDz85QzUr+V3IlEzDjBQyDtJ5RVG9eMdNHoH051frXqOJIRdSEQaSuV1NyxZiyHZLE3cJwJ85bFDotWbjg7MLqupkT4l1RZG4NRtizlZ4nS/5yvobN2ss23abi4=,iv:qqgvMqGgUxNwiDq9jbakFCguxciJcnR4uF5CyXwcEVM=,tag:jjn5iKOIUQNoEatu4JLWpw==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:zD2kJfWkXrirqZ2hbKBg/b/IT+d57OKvLlHTrU9Qf1FIbAA6WQMSczMehyjPVKhwB16haR2hm/cAmGSnLxbu9rh/0F2lI2XcIpBIuhoxExC45q7o7Ew1OOVmtp7jm12ON3O0U8TPd4AdhugX/yzU5JmLsU1zOdnGx6YPNuQ=,iv:VnSZSqDJxNQ2KRV3Vbu+X+pg7CePRj0dUDrJSiUIFqA=,tag:BIPm2MKSYaGcW9WLyW0+fw==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHYXdSZFc0Yko1NnpKb3Bn
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBROWhvZFBHZUZLUlJ0MmhL
-            N3F1Z3lzVXpZUXFHZVhsdU40N3cyakVmaXo4CnA1N3J1VWlldnlNK3g5TzhCYi9G
+            dnUrNmYzcTJWM1RHc2NYY2sxVUdxZkduSUdjCnRYcGpCT1NTUUQ2K3kwSUxDVW1l
-            c05ldW5sYVVEWnkyU2V5MGtJRkZCUVUKLS0tIENPM002YmxUNnlNVTlMRC92cy90
+            azVpWjNxNE8vRGpUdXdQR0VSMnlXZkkKLS0tIGczaWhxSmhXVVN0YWpTYTRieXlr
-            dGdEWGNaQ2pBdmlpcjB5T2ZCNTV2K0kKghkNGGCiTWIq3t49sX60xZS+TdSmxPFr
+            WWFyOXEyNzh6aVlXT25maG83SVNrdUUKAdPPCm0nTIo5WIEKzsAzNoxK1LfpdSQd
-            pfy9B0MiS5+gKf4zoRZQAtNgaJ0NgIifybu4s3qlXqoVawjGBUQZhQ==
+            r63l6csfbkWl079xm3ZVq1UV+jfEX4mRn6EsYMH/i+tVgjQc0g0BKQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:24Z"
+    lastmodified: "2026-08-26T10:28:33Z"
-    mac: ENC[AES256_GCM,data:jIiC9Qymv7q4KJD9O6c+Dc1sgtHH1kIwuYvOjnWE0GKG8qQXdsLl5TB6NR0MuahILUzpR5Q9og5YUnaKKFH8OisAuH2N1d5UtL9gRFiK5nw/Z5uRNoY+0FRPwKCP3YV4Ha+n22wi3+oP8PYKbXhy7quma/czeQpvH+J2b1HXD6o=,iv:TxdKfWV7LJzqQ5nN0fEefakDGnVycqnX9foLpE1j+ao=,tag:H9ZUYU1PYeFvLULfjTXKYg==,type:str]
+    mac: ENC[AES256_GCM,data:2G2hyItyAKvYxOn5m3rgNRzXsn/Gmrhj/xLiCz2cl88E59rnlujUlgi1kKMFv7QyXK9dQtr78EIQGdSmC+jItoJlC9zNMGD5AtDaij7CwdUo75zPy1Y8LKo9K1Xua9gfS2vCHbBCI8cwGVwE5TfIfE2lB04zjVLaTPbp5UgqjfY=,iv:bl13cjoDhSloNebCTTPZ7Pw37bKbLuFDcMmQh0LJndM=,tag:BkXXAMd6ySxRXvZZIaNzNw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/infra/longhorn/longhorn-system/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: longhorn-backup-target-secret
     namespace: longhorn-system
 stringData:
-    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:KZjYtMyYW5XSZO12M2nEMxAVWFY=,iv:QmwPDhZfZJ3OOD4x/l3Y9HSAfzVZkt8+uhOwb3tQaxk=,tag:lfVlUSPAu8T96lglOlukjg==,type:str]
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:+BQQLrwxJgIXEVj6XSZofMirIRY=,iv:aR5z0STuo0tVQdw3LWJ5ZQWlztRqc85OlWplEQgjyEk=,tag:EhItdTZLzwzXL3V5hJLvNA==,type:str]
-    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:uJfUztmrDbms/lfzaz2uGkdVyT1abC2EqQtJEgbCaWc92jUg2stzbQ==,iv:OdU+RMXNDPMxtD9wIoVmlGz9fmPI9pc9dT763Yn7KJM=,tag:hbVcDdIAaXSKHZZFa3kTFA==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:yeSP7adfBHA7fh+knB2CPKUTJMmdSv0yHaLwcYCz0W6lUX4lgRYW2g==,iv:d8Fl4/jZYDdmfmXBZP0Uft4Wt9PJCLEed3DYuOcM96M=,tag:Z1oWUn55gKViexmW6YcPTQ==,type:str]
-    AWS_ENDPOINTS: ENC[AES256_GCM,data:zX95c4IG0oazd9O5XUDCfdIjzqCUxI6SbVCOJrM1bNz3rqab/YHbfqPojRWtVSludcBteN3Sqdlb4QKsnQ==,iv:q5Ber3jzCwMXe+UUOfyG6cnS0U33rUuoQT2xm3NP+p4=,tag:sAKnicaihC9NmuzHT2ahTA==,type:str]
+    AWS_ENDPOINTS: ENC[AES256_GCM,data:27yF4AQMqa+NIY0VjGHCoPXV5VinvywFTHzN6O4caOcbGevYHB3aCoX+XvNAFSycd7pewmBd3MD8VB8Z4A==,iv:rgxaOeOC+hSpXhf+5jIiYrBbDiSx+K5zdA5LJUp63EY=,tag:G+Tf0zYUxVj/4VJulGexVg==,type:str]
 sops:
     age:
         - recipient: age18hhmdmupj90zjgjpxk3z5cf3lx36hcznnmqsp0fpyg50823pudrqjupydt
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDV0F4eU5qR3ZOQktRN1lG
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtaFRuV2ltTVcyY1gyTkhp
-            T0kxbUhKbDBZMFhmVjZRN0FZK3dmbkRvMFRJCjFFZkNnY1ZrNm43OG5hQm9XMU5v
+            RnhyZ3YwUmhnVlQ2MlFwRkRYbERFRVpKbVFJCkdqY2ZQZmRpZk4ybVpkVGFCWDhj
-            TWVOMkJ1eW1FRUpwN1ZNQ2Y0aFFOY2cKLS0tIEROc1lQanJmV2o3MjFodldnNjhL
+            UWxSK3RzSS90S3N6cHNhTjNMaHN4WG8KLS0tIFNCUWE3VHhNMC90QmNJM2p6azVM
-            a2p1WmIvbFhITGs3bUgvN3pVVEZyTDAK5Yzuxw0faQmOnJpVUq4ZHVxSBa2f08KC
+            ZTVvRFZtTEY0OFZPTVEraytvTDJITWMKkO3k936r4ewmQAS7aRTfSlK99aJqgLjF
-            0LQ7aR3W5b+Ug7tm3dBDW8XebDBXps6Kop7QOMmq7Fdsn8y0Cx6cdA==
+            gPa8k8X9euxkWsz4jW+1hVFGmQbue1eRvj4QgBT6/p8IATb4Jfnzaw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:25Z"
+    lastmodified: "2026-08-26T10:28:34Z"
-    mac: ENC[AES256_GCM,data:2m3ORY0xkaHAeJFj66Hzgn1UJH2BAsQcuYeyae8Yn9q9qYPh9fQiudERJGU4q+FJq2IkJg7JR9anS95X+9RmpePRqiq5MgMmuJJ//vW+8Is4kuJoslC1nl435eGLD1ExTY5SffxZgdveZIGUAhTaQdcw8ndwrfzCKBrfqkVPv7M=,iv:ti7PqZKDlviOc0g3XyqoSzLTfwhxTw2F20MHmDeTpkA=,tag:M9oqkkYd9/CUTPEHhrCSaA==,type:str]
+    mac: ENC[AES256_GCM,data:/FAZZ7T48tTxIovjvcVxOxNatPBuPiyRO19sBsXhsyEn4pu9M7rHdhgmoBldlg9rKI5RP/kntkQoKtQzjLDSEZVUWEHXQ8UIbMLdfFw8ifItxayILy7K1TMPekJp0jfalorzii7oqBnc9dlJXePG+cD1LQVPEMHhvzcj/f8NS2U=,iv:6owWcyi1V33MHAGeOKSWRKxvtV/Cvd52CNL0cWcFVCs=,tag:q0hxLoA9ZghpXeqWcHoFVg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/infra/longhorn/s3-backup-proxy/secret.enc.yaml

@@ -4,24 +4,24 @@ metadata:
     name: s3-backup-proxy-secrets
     namespace: longhorn-system
 stringData:
-    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:T766XOffaChopf+eTZ9cISONv9w=,iv:fCMWcPaKFxzJ+pjyU+JnnCbtBSsftDksWq9SPDcz6IU=,tag:xVheoyt6cXoj8PTZJFo2qA==,type:str]
+    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:IGkZMeXKi08HLTnW6eJrdQgp+KE=,iv:xYhv4oIEbUOX1JByHkqHnbNL6PMz3ARTWRg7pHS/UD0=,tag:NfKW7ubjVAyVr7JdprM4tw==,type:str]
-    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:v5W8rP2OHhQmedLnhyAGPFPtS/NxJBhTROYLwsdVl6lgcSiuI1CgoA==,iv:2JfkG+L+tisEGYfnw9varTnuCZeNdTeyZ1iVgljhOBQ=,tag:TilTJ+UuQ0FW8F69beyLgw==,type:str]
+    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:Ch6HFGzOuX46Ilxr4ewV0gSRXxABbFR3LsQlITmflNluPYzkTkr/gw==,iv:hITaX8ch5N7Uyoq/FrjJ6edk6MsN55jCgEQu9mfv2aE=,tag:C9ZMVmcN7Fk2TN9AKQmprA==,type:str]
-    CRYPT_PASSWORD: ENC[AES256_GCM,data:t1wr7hIZD4rUXdRWe71pAQcFnmTvwEdI/KFxjtP9URdAzm7dZdsF3rJPiw==,iv:16ScaJJVGN9kOHxLDZ4BxSUGRbgHHsS/2fhiap7CJg4=,tag:omZRoHWSkcl/29+NhkPh5A==,type:str]
+    CRYPT_PASSWORD: ENC[AES256_GCM,data:Gcii8QqKa9BysiCa6ZkgcLC5WTcCZrAgu7P79WlTZyEWa5y7Y9saESHALQ==,iv:+/MXrVhqxMthl9PoCJS6v1TWr8yFdsukGFwnc57hG3s=,tag:tTsEP5VF3inPK2PgDELztA==,type:str]
-    CRYPT_PASSWORD2: ENC[AES256_GCM,data:JqR0MmxQV7vtFTUVrfyntKINdbaMXw7nK5SQP6a/lQgOxDMqgJamfSM07Q==,iv:jD+lpex4Y1XfqzXKn/pQFqGthAYgMs4K09ByE6Y6A48=,tag:dj+a7Ue+qPjVHZ62Xxsg4Q==,type:str]
+    CRYPT_PASSWORD2: ENC[AES256_GCM,data:XJG3q7nDAWJ35+AlSn92AMCgaj2S5kV10Fu618t0ssi7B9ofavNTGXb6eA==,iv:8YxmGdpkh5old4HFVFT4BD4yDFFcs+aW1s2le/1BXz0=,tag:oSLoa9KnEizW1QakA9uJgg==,type:str]
-    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:5e2zXYWBdtzKmTIZLYHH3C8zzXo=,iv:hxyuVAMuzR2+HjGyUM+zO2OahgfNkwOSYGnyrBlfrys=,tag:PQjB+s8f33afne1I5uUL3g==,type:str]
+    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:UoUdnb1eW1guaXRHHPUjXWj8r88=,iv:LYETftuDZSflZUhtuNBRbwrDDUD83jIIisz8TZbWdJk=,tag:KMyIy4QIv7AMOpw3NbWXmQ==,type:str]
-    PROXY_SECRET_KEY: ENC[AES256_GCM,data:sXrDfcA7muaD+4IQED6iVv00BIBcyo3SuScQyIcwgpyd7ptEx6SyWw==,iv:Mz4jpTRGNlSHmyZ+x5cFOv1OtCs1iU+9Xd7DNBwQpb8=,tag:wqVoIcK2g4o/29PGTsZXHA==,type:str]
+    PROXY_SECRET_KEY: ENC[AES256_GCM,data:0VAzeJOwWEshqrQi9gISOKdM29gMAd8dsRPc9c+WTFt2Id+59tO5Mg==,iv:ZVSCRmKKG5wAKdPrHId8VwfcDj34HbQlO5IPyOAQrd8=,tag:piC06vgROa0wzLc2zoVc2Q==,type:str]
 sops:
     age:
         - recipient: age15vc3geq4lsec69rnxczluvwgcexeqae02zxzjpswsuatthaasu7qzath48
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSSWRTbEdkaTR6RkpnL0Ry
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWOXZJSmtYWHRWUnBJZGVU
-            QlZzQmhKa0Flb1VlK3FqU1c4MFBkY1ZiSFcwCjdzOG1xc3JWZ1k0WHZ1cEo0ZnNY
+            dnlsdkZGNk5GNG13Ly9FUFJ0cXZMdXhRNUg4CkN6TWNLN0dybGxqZTR2K09ZRWls
-            U0x5UjFnT0N4QUs3UzV1NG1CbXRja3cKLS0tIGY0Y1ByMTlENkdFRkRkNjZUK1V3
+            ZWFYVmVCSllHUENBcnMrR01KY3JDSjQKLS0tIEkzZVlUWEhUSFArb1JxSHl5Q0tw
-            aEEzbWhIMVdTVUtKRmlvZVR3dHRSKzgKU5HeZCIhWiRSSJk1egqrs8hH4F3eAaX7
+            UVhBY2NiUlBnTEEyRE9LSHVGZ3k2QkkKCcOvQ7vZLqW88Gj+9OoRuWXFQuRWtnIB
-            feym08J2r9l9rSF6m7UGSUWrrlSchqvSQ7ByZdEDdNmFaySoBoscmA==
+            aEdsOUnZOda/at6UIxLe3XuBj+vewhS2P0bOpJ6ZeuvQ2AhSlOT60g==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:28:26Z"
+    lastmodified: "2026-08-26T10:28:35Z"
-    mac: ENC[AES256_GCM,data:+sZHer0s5XLsrIM8/Qkq8ucP1d7HF+X3AAnzmmnhvZ45lcuW6kCwAJVAF/nCTjNbHaUpwOmsxwMZ5CkAKN6ASmvLnWu0AOta5HmZgW2scl6KU3V2Ehzj7UbPHipcg+UbeHudjjESMYTdwWfnCJughc7U+IEcJNVZzTCpsnk/d8o=,iv:eFfxDxOVUV2OJg0eibQ67mgMHZ8eUcO8UboxmCcNcQ4=,tag:PYiTO77DHjvgBlxvELxQ2w==,type:str]
+    mac: ENC[AES256_GCM,data:7Q3lr8efEFlnA89RBeAmRpq+VX/T55Fu/6NJMs3BZC/8TYCNSvMshd+lbKU8vyuWLnE0N0NA7Hnxf4ykvknMETrPDeOMnS250S/9dknp0oTE6VrIN0HJMq8xBKyFh8Y0k8kRkZoICTM6t3kFXRsOG7M0CKN9s60bhVw5K77A0zA=,iv:fanKdbFdVEZrf32Lx2FOVwL/nPEbVh4kicoVcjxP90U=,tag:Rj/zYd/dKTQQRBDdR6rPqw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0